Server-Side Request Forgery (SSRF) vulnerability in Next.js Server Actions
Key Information
- Vendor
- Vercel
- Status
- Next.js
- Vendor
- CVE Published:
- 14 May 2024
Badges
Summary
Next.js has two new vulnerabilities related to response queue poisoning and Server-Side Request Forgery (SSRF) in certain versions, CVE-2024-34350 and CVE-2024-34351, both rated as high severity. Exploiting these vulnerabilities can lead to desynchronized responses and potentially compromise server operations. The vulnerabilities are in the Next.js component enabled by default, and have been patched in versions 13.5.1 and 14.x. One of the vulnerabilities, CVE-2024-34351, can be exploited in a way that allows an attacker to manipulate a front-end server and map incorrect back-end responses. A proof of concept for this vulnerability has also been published. The exploitation of these vulnerabilities can lead to serious consequences and it is critical for Next.js users to upgrade to the latest versions to prevent exploitation.
Affected Version(s)
next.js = >= 13.4.0, < 14.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
CVSS V3.1
Timeline
Vulnerability published.
- πΎ
Exploit exists.
First article discovered by CybersecurityNews
- π₯
Vulnerability reached the number 1 worldwide trending spot.
Vulnerability started trending.
Vulnerability Reserved.